What you will learn in this TP
- Read an agent's state
- Cause and observe a failure
- Produce a diagnostics bundle
- Alert on offline agents
Introduction #
What you will learn in this section
- Read an agent's state
- Cause and observe a failure
- Produce a diagnostics bundle
- Alert on offline agents
Context. An agent stopped sending data. You reproduce the failure in the lab to learn to recognise and fix it quickly.
Prerequisites: Lab 1 · Estimated time: 40 min
Hands-on #
Guided steps, with their solution.
1. The normal state
Record the state of each component and the effective policy.
2. Cause a failure
Why? Fleet Server stopped: the agent keeps running with its last policy, but Fleet sees it offline after a few minutes.
3. The diagnostics bundle
Generate the bundle, copy it to the host and find the useful files (state, policy, component logs).
4. Fix and alert
Restart Fleet Server, check the return to healthy, then list offline agents through the API: this is the query to use in an alert rule or a monitoring script.
Difficulty level : ●●●○○ (3/5)
My progress
Sign in to track your progress and take notes. Sign in
💬 Questions about this lesson
No questions yet: be the first to ask for help or share your configuration.
Recommended Articles
Monitoring, upgrading and troubleshooting Elastic Agent
Operate an Elastic Agent fleet: states in Fleet, agent monitoring, batch upgrades, diagnostics, l...
Elastic Agent on Kubernetes
Deploy Elastic Agent on Kubernetes: Fleet-managed DaemonSet, Kubernetes integration, kube-state-m...
Installing Fleet Server and enrolling Elastic Agents
Set up Fleet Server, create a policy, enroll Linux, Windows and Docker agents, understand tokens ...
Elastic Agent: architecture, Fleet and integrations
Understand Elastic Agent: single collection agent, Fleet and Fleet Server, agent policies, integr...
Elastic Agent or Beats? Choosing and migrating
Compare Elastic Agent and Beats (Filebeat, Metricbeat, Winlogbeat), know when to keep Beats, and ...
Agent policies, integrations, data streams and pipelines
Build agent policies, add integrations (System, Nginx, Custom Logs), choose namespaces, customise...
Standalone Elastic Agent, Logstash and Kafka outputs, and OpenTelemetry (EDOT)
Write a standalone configuration, ship to Logstash or Kafka, and use Elastic Agent as an OpenTele...
Elastic Agent in production: best practices
Elastic Agent best practices: security, policy organisation, volume control, Fleet Server high av...
Elastic Observability: logs, infrastructure, APM and synthetics
Elastic Observability features: log exploration, infrastructure inventory with Elastic Agent and ...